LEGAL
Privacy policy
Last updated 7 September 2026 · governed by the laws of JURISDICTION
Every capitalised placeholder below (company name, address, registration number, jurisdiction, retention periods, supervisory authority) must be replaced, and a solicitor in your jurisdiction must review the result. Publishing this as-is is worse than publishing nothing.
Who we are
COMPANY_LEGAL_NAME (replace before launch) (“AgentNorth”, “we”) operates MY_DOMAINNAME and the AgentNorth rendering API. We are the data controller for the personal data described here. Registered office: REGISTERED_ADDRESS. Company number COMPANY_REGISTRATION_NUMBER.
You can reach our privacy contact at privacy@MY_DOMAINNAME, or by post at the address above.
What we collect, and why
We collect the minimum needed to run the service. There is no advertising network, no data broker, and no sale of personal data.
- Contact form submissions — your name, email address, optional company, chosen topic and message. Lawful basis: consent, which you give by ticking the consent box before sending. Purpose: replying to you.
- Technical request logs — timestamp, requested URL, HTTP status, response time, and a salted one-way hash of the IP address. We do not store raw IP addresses at rest. Lawful basis: legitimate interest in operating and securing the service.
- Abuse-prevention counters — a hashed identifier and submission timestamps, used only to rate limit the contact form. Lawful basis: legitimate interest in preventing spam and automated abuse.
- Essential cookies — see the cookie policy. No analytics or advertising cookies are set unless you accept them.
What we do not collect
We do not require an account to use the API, so we hold no usernames, passwords or billing profiles for API callers. Payment happens on a public blockchain between your wallet and ours; we do not receive card details or bank information.
We do not run cross-site tracking, fingerprinting, session recording, or behavioural profiling. We do not use automated decision-making that produces legal effects for you.
Content you render through the API
When you call the rendering API, the target URL and request parameters are processed to perform the render, and are retained only in short-lived operational logs. Rendered output is returned to you and is not retained beyond the request unless you explicitly store it. If the page you render contains personal data, you are the controller of that data and we act as your processor; a data processing agreement is available on request.
How long we keep it
Contact submissions: {{RETENTION_CONTACT}} (suggested: 24 months), then deleted. Operational logs: {{RETENTION_LOGS}} (suggested: 90 days). Rate-limit counters: rolling 60 minutes. Blockchain settlement records are public and permanent by the nature of the network — we cannot delete them.
Who we share it with
Only processors necessary to run the service, each under a written processing agreement:
- {{HOSTING_PROVIDER}} — hosting and origin infrastructure.
- {{CDN_PROVIDER}} — content delivery, WAF and DDoS protection.
- {{EMAIL_PROVIDER}} — delivering our replies to your enquiry.
- Law enforcement or regulators, where we are legally compelled and after review.
International transfers
Where a processor is outside JURISDICTION, transfers rely on {{TRANSFER_MECHANISM}} (for example Standard Contractual Clauses or an adequacy decision). Details available on request.
Your rights
Depending on where you live, you may have the right to access, correct, delete, restrict or object to our processing of your personal data, to withdraw consent at any time, and to receive your data in a portable format. Email privacy@MY_DOMAINNAME and we will respond within {{RESPONSE_WINDOW}} (suggested: one month).
If you are unhappy with our response you may complain to your supervisory authority — {{SUPERVISORY_AUTHORITY}}.
Security
Transport is TLS-only. Contact submissions are stored outside the public web root with restrictive file permissions and only a hashed IP. Administrative access requires single sign-on with multi-factor authentication, and administrative actions are logged to an append-only audit trail. See the security page for the full control list, including the limits we do not claim to solve.
Children
The service is intended for developers and businesses, and is not directed at children under 16. We do not knowingly collect data from children.
Changes
We will post material changes on this page and update the date above. If a change requires your consent, we will ask again rather than assume it.
QUESTIONS ABOUT THIS DOCUMENT
Postal enquiries: COMPANY_LEGAL_NAME, REGISTERED_ADDRESS — replace before launch.